Claude in Chrome is generally available
02:00 · August 26, 2026 · Claude Blog

Summary
Claude in Chrome has reached general availability for all paid plans, allowing the model to perform browser-based tasks without requiring explicit approval for each step. It can read and interpret the current page, enter text, click links, navigate across sites, and complete forms while relying on the user’s existing sessions and credentials. This extends Claude’s reach to internal dashboards, legacy systems, and vendor portals that lack direct API connections.
The release incorporates layered defenses against prompt injection. A growing library of attacks, drawn from automated generation, red-teaming, and production monitoring, is used to retrain both the model and supporting components. Probes inspect tool outputs for hidden instructions before they reach the model; when an injection is suspected, Claude receives a warning and may seek user confirmation. A separate safety classifier then evaluates proposed actions against the original user request and blocks any that deviate.
Evaluation data indicate that these measures reduce successful attacks to near zero on recent models. On an updated red-team benchmark, the combination of probes and the classifier produced a 0 % attack success rate against Claude Sonnet 5, Opus 5, and Mythos 5, with only a 0.3 % rate recorded for Fable 5 in low-severity cases. Earlier models without the full safeguard stack showed higher vulnerability, confirming the incremental value of the added components.
Enterprise administrators can enable or restrict the extension through organization settings and can confine its use to approved domains. Users install the extension from the Chrome Web Store; it remains limited to the desktop Chrome browser and does not replace the Claude desktop application for local file or application access.
Why it matters
This update is highly relevant for product teams and builders as it introduces autonomous browser capabilities for Claude, opening new avenues for automating workflows in legacy systems and internal dashboards. Furthermore, the detailed breakdown of prompt injection defenses provides crucial security insights for developers building agentic AI solutions.



